Yan Rong Ge discovered that the peel_netstring() function incl_netstring.c does not validate the "length" parameter of user input,which can lead to an out-of-bounds memory access when processingcertain Heartbeat messages (CVE-2006-3121). Furthermore an unspecifiedlocal DoS issue was fixed (CVE-2006-3815).

Impact======

By sending a malicious UDP Heartbeat message, even beforeauthentication, a remote attacker can crash the master control processof the cluster.

This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200608-23.xml

Concerns?=========

Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttp://bugs.gentoo.org.